Add CI: build/test, CodeQL and zizmor workflows #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL static analysis for the Java sources. | |
| # Results appear under the repository's "Security > Code scanning" tab. | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| schedule: | |
| # Weekly run so new CodeQL queries are applied to unchanged code too. | |
| - cron: '27 4 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (java) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3 | |
| with: | |
| languages: java-kotlin | |
| build-mode: manual | |
| - name: Set up JDK | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| cache: maven | |
| # Manual build so CodeQL traces the exact compilation. Skip tests to keep the analysis build fast. | |
| - name: Build | |
| run: mvn -B -DskipTests package --file pom.xml | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3 | |
| with: | |
| category: "/language:java-kotlin" |